6.6

CVE-2026-44725

EMQX: Stale plugins allow grants amplify a compromised admin/API key to remote code execution

EMQX is a scalable and reliable MQTT broker for AI, IoT, IIoT, and connected vehicles. Prior to versions 5.8.11, 5.9.3, 5.10.4, 6.0.3, 6.1.2, and 6.2.1, the plugin-install REST API and dashboard upload accepted stale grants created with emqx ctl plugins allow because there was no five-minute grant lifetime or SHA-256 package binding. An attacker with a compromised dashboard administrator credential or API key with plugin-install permission who finds a stale allowed name and version can upload attacker-controlled bytes under the allowed .tar.gz filename through POST /api/v5/plugins/install or the dashboard plugin upload. The broker then installs and runs attacker-controlled Erlang code with the privileges of the EMQX process. This issue is fixed in versions 5.8.11, 5.9.3, 5.10.4, 6.0.3, 6.1.2, and 6.2.1.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
Herstelleremqx
≫
Produkt emqx
Version < 5.8.11
Status affected
Version >= 5.9.0, < 5.9.3
Status affected
Version >= 5.10.0, < 5.10.4
Status affected
Version >= 6.0.0, < 6.0.3
Status affected
Version >= 6.1.0, < 6.1.2
Status affected
Version >= 6.2.0, < 6.2.1
Status affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
security-advisories@github.com 6.6 0.7 5.9
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE-345 Insufficient Verification of Data Authenticity

The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

CWE-672 Operation on a Resource after Expiration or Release

The product uses, accesses, or otherwise operates on a resource after that resource has been expired, released, or revoked.

https://github.com/emqx/emqx/security/advisories/GHSA-cp9x-5qwc-fj6r
https://github.com/emqx/emqx/pull/17200
https://github.com/emqx/emqx/pull/17201
https://github.com/emqx/emqx/commit/2f926359fa847dd9928a8e94d3e342f5621806f4
https://github.com/emqx/emqx/commit/efa1ca1bef1517f1f87e1d562f8db8750b6d6ce3
https://github.com/emqx/emqx/releases/tag/6.0.3
https://github.com/emqx/emqx/releases/tag/6.1.2
https://github.com/emqx/emqx/releases/tag/6.2.1
https://github.com/emqx/emqx/releases/tag/e5.10.4
https://github.com/emqx/emqx/releases/tag/e5.8.11